feat: add bounded graph investigation API

[udgover]

Summary

• add strict POST /api/v2/graph/explore item and query scopes
• enforce atomic RBAC, one-hop traversal, compact projections, stable ordering, and node/edge/runtime budgets
• preserve directed parallel relationships and fix composed legacy graph filters
• emit sanitized operational metadata while suppressing request bodies

Dependency

Stacked on #1337. Merge or rebase that prerequisite before changing this PR base to main.

Validation

• make check-backend
• make test-backend: 190 schema, 225 API, and 31 core tests passed
• disposable real-stack suite: 10 passed

Security and data handling

Explicit item scopes fail atomically when any item is absent or inaccessible. Query totals, nodes, and induced edges are RBAC filtered. AQL values use bind variables; response, anchor, hop, and runtime limits are server enforced. Logs omit IDs, criteria, labels, descriptions, credentials, and request bodies. Tests use synthetic data only.

Rollback

Revert the additive endpoint commit. No database migration or persistence-schema change is involved.